While I could guess at a few of these, I was far from an expert and in any case had no wish to spend several hours learning how to translate my own terrible rules into proper Hashcat syntax. For instance, one rule might take every word in a wordlist and add two numbers to the end of it, starting at 00 and progressing up to 99 this would hit every password from 'arstechnica00' to 'arstechnica99.' People commonly form passwords this way, so such a rule would likely produce many hits but at the expense of a 100x increase in required number of guesses.Īll serious password cracking programs can handle such rules, but the format for creating them differs a bit-and besides, to create solid rules you first need to know the most common ways of forming passwords. Such rules dramatically expand the usefulness of a particular wordlist by generating variations of those words that might be used to form someone's password. I looked at Graham's next step, which was to apply 'rules' to the RockYou dictionary.

I was, after all, in the same boat as a noted security researcher like Graham, and here we were sailing together on the same journey, docking at the same ports, encountering the same difficult sea conditions. This might explain my low success rate so far, and the thought gave me some much-needed encouragement after two fruitless hours of trying to convince myself I wasn't as bad at this as I clearly was. Perhaps the same culling had been done on my list of hashes, with the hacker-oops, I mean 'password recovery specialist'-releasing a list of only those hashes he couldn't easily crack.

Rockyou wordlist